CVE-2025-62724

Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)

State: Published
Severity: 4.3 Medium
Published: Nov 20, 2025
Updated: Nov 21, 2025
Reserved: Oct 20, 2025

Description

Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. This vulnerability impacts sites that use the file browser allowlists in all current versions of OOD. However, files accessed are still protected by the UNIX permissions. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-61 UNIX Symbolic Link (Symlink) Following
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Affected Products

Product	Versions
ondemandOSC	< 4.0.8Affected < 3.1.16Affected

References

https://github.com/OSC/ondemand/security/advisories/GHSA-vjpg-34px-gjrw

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.